Upgraded from jackson 2.10.5 to 2.10.5.1 -- this helps with a serious v…

[giuliodambrosio]

…ulnerability

Pull Request Checklist

• [√] Have you read through the contributor guidelines?
• [√] Have you signed the Lightbend CLA?
• [√] Have you squashed your commits?
• [√] Have you added copyright headers to new files?
• [√] Have you updated the documentation?
• [√] Have you added tests for any changed functionality?

Fixes

Fixes #xxxx

Purpose

Upgrade the jackson dependencies to the latest version: mainly in order to import a vulnerability fix for a serious vulnerability: CVE-2020-25649

Background Context

Why did you take this approach?

References

Are there any relevant issues / PRs / mailing lists discussions?

[raboof]

Thanks for the update!

This could be controversial since jackson 2.10 is not binary compatible with jackson 2.12.

A more conservative option might be to upgrade to 2.10.5.1, which is also not affected.

We'll have to plan to upgrade jackson at some point, though...

[giuliodambrosio]

Thanks for the update!

This could be controversial since jackson 2.10 is not binary compatible with jackson 2.12.

A more conservative option might be to upgrade to 2.10.5.1, which is also not affected.

We'll have to plan to upgrade jackson at some point, though...

Sounds good, I'll downgrade to the least version needed to fix that vulnerability (2.10.5.1)

[giuliodambrosio]

So what happens now @raboof ? I don't think I can merge it, can I ?

[raboof]

So what happens now @raboof ? I don't think I can merge it, can I ?

We first wait for travis to run the tests - I don't expect problems there.

After that the PR can be merged by me (or anyone else with write access), and then we should probably do a release. I'm not sure I've done that before, but judging from https://github.com/playframework/play-json/blob/master/RELEASING.md that seems fairly straightforward, so I might have time to take care of that as well.

[giuliodambrosio]

thanks @raboof . Do you have an idea of how long could it take to have this patch released ?

[raboof]

https://github.com/playframework/play-json/releases/tag/2.9.2 should be on its way to Maven Central now

[giuliodambrosio]

Thank you @raboof , much appreciated !